Executive brief
NEX-Forms is a WordPress plugin used to build and manage web forms. A security flaw allows unauthenticated visitors to submit malicious code through these forms, which is then stored on the website. When an administrator views the submitted form entries in the dashboard, the malicious code executes, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions on the site.
Technical details
The NEX-Forms WordPress plugin (versions prior to 9.2.3) fails to properly sanitize and escape user-provided data submitted through its forms. This results in a stored cross-site scripting (XSS) vulnerability. An unauthenticated attacker can submit a form containing a malicious JavaScript payload. When a site administrator views the submitted entry within the WordPress admin dashboard, the payload executes in the context of the administrator's browser session. This can lead to session hijacking, unauthorized administrative actions, or further site compromise. The issue is fixed in version 9.2.3.
Affected products
- Unknown NEX-Forms < 9.2.3
Timeline
- 2026-06-26: disclosed
- 2026-07-17: advisory: NVD publication date